Malicious PDF — malware analysis report

Static analysis result for SHA-256 7adef9a59d6f6687…

MALICIOUS

PDF

68.4 KB Created: 2021-09-27 19:16:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 584963b8e6c5e3def4027128da43ebb3 SHA-1: 7a5abae610bb68968f22fa5e4622e01098a0a945 SHA-256: 7adef9a59d6f6687f51b9647199013d94828ed286fe926e39ac0a0c41db3ad09
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains numerous embedded URLs, many pointing to PDF files hosted on various domains, suggesting a link farm or redirection mechanism. One notable URL, though marked as benign, is presented as a "legit pokemon go hack", indicating a social engineering lure. The presence of PDF-specific heuristics like PDF_SEO_DISPOSABLE_LINK_FARM further supports the phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://liyangah.com/Upload/file/xitipisazesisezudosijemas.pdf
    • http://jvmont.eu/userfiles/file/66498506043.pdf
    • https://turbooto.vn/upload/files/93818086541.pdf
    • https://ystechpro.com/nbloom/fckuploads/file/87899491176.pdf
    • http://cgt-fo-csc.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1613cc1115795b---saxipuvofomi.pdf
    • http://wedding-box100.com/uploads/files/202109230625214976.pdf
    • https://bientannamhuy.com/wp-content/uploads/files/79307812616.pdf
    • http://coytex.net/ckfinder/userfiles/files/94906142336.pdf
    • http://accessiblevehicleservices.com/userfiles/file/vixajejalakiriwowunumejew.pdf
    • https://parklanehotel.asia/userfiles/file/fawabiralopij.pdf
    • https://csam-villepinte.org/uploads/images/file/sovoputepaxu.pdf
    • http://thinhhoanggia.vn/Images_upload/files/dojiwibaxane.pdf
    • https://bloomlight.pl/_bloom/file/kopugibatiwinidoma.pdf
    • https://hoangvan.vn/wp-content/uploads/files/rowawowekumusitaz.pdf
    • http://hkalc.com/userfiles/nolaxemu.pdf
    • http://th-hl.com///upload/files/sotonatesafufopukitamu.pdf
    • https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1614099f9d7a35---xiwumaxotepelukizexivik.pdf
    • https://kisikana.hr/UserFiles/files/818641604.pdf
    • http://vasekurzy.cz/userfiles/file/butezojarurub.pdf
    • https://hoangphatdanang.com/uploads/image/files/91011985460.pdf
    • https://alakharia.com/public_html/userfiles/file/62039863239.pdf
    • http://ffarchitettura.it/userfiles/files/diribelovene.pdf
    • http://whatcanidoforyou.eu/publish/file/40082771488.pdf
    • https://advik.net/userfiles/file/rovadunisiz.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=legit+pokemon+go+hack
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aecc.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAECC 16792 bytes
font_01_sfnt_off0000c6e3.bin
74fdf05f1d6159f4aa8ff6861095ad025dfa9f4b5a56ee09be9ee7233a1d1d79		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC6E3 10556 bytes
font_02_sfnt_off0000debe.bin
c4f9a9bd315bb8e37281e183545d5f9a565f493e77b296d834a3eb96833d5d70		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEBE 14840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.